/usr/share/polkit-1/actions/org.gnome.DejaDup.policy is in deja-dup 37.1-2fakesync1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 | <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD polkit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/software/polkit/policyconfig-1.dtd">
<policyconfig>
<icon_name>deja-dup</icon_name>
<action id="org.gnome.DejaDup.duplicity">
<description gettext-domain="deja-dup">Restore</description>
<message gettext-domain="deja-dup">Privileges are required to restore files to system locations</message>
<defaults>
<allow_any>no</allow_any>
<allow_inactive>no</allow_inactive>
<!-- Don't use _keep here. It exposes us to a potential attack where anybody in the session can use our script as root to overwrite files using just our cached auth. Unfortunately, the way deja-dup is currently written, this means that we might ask user twice for root password if backup is encrypted. We can try to solve that separately, it's better than a security vulnerability. -->
<allow_active>auth_admin</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.exec.path">/usr/lib/deja-dup/duplicity</annotate>
</action>
</policyconfig>
|